From: Thomas Hellstrom <thellstrom@vmware.com>
Date: Mon, 14 Sep 2015 08:13:11 +0000 (-0700)
Subject: drm/vmwgfx: Fix up user_dmabuf refcounting
X-Git-Tag: omap-for-v4.3/fixes-rc5~94^2~1^2~6
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=54c12bc374408faddbff75dbf1a6167c19af39c4;p=pandora-kernel.git

drm/vmwgfx: Fix up user_dmabuf refcounting

If user space calls unreference on a user_dmabuf it will typically
kill the struct ttm_base_object member which is responsible for the
user-space visibility. However the dmabuf part may still be alive and
refcounted. In some situations, like for shared guest-backed surface
referencing/opening, the driver may try to reference the
struct ttm_base_object member again, causing an immediate kernel warning
and a later kernel NULL pointer dereference.

Fix this by always maintaining a reference on the struct
ttm_base_object member, in situations where it might subsequently be
referenced.

Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
---

Reading git-diff-tree failed